= Tuning Guide

== Main Server

* If you have a large user base and/or many authentication requests try
using a scalable authentication mechanism like ldap or sql.
* Enable noatime on all the freeradius log files or better yet on the
freeradius log directory.
* Always use the latest cvs version. It will probably contain a few
fixes and enhancements.
* Always try to use the least modules possible. In particular if you can
avoid it do not use the detail and radwtmp (files) modules. They will
slow down your accounting.
* Use the users file to only set default profiles. Do not place any
users there. Keep it as small as possible. Always set default attributes
in the users file and don’t fill the user entries in ldap/sql with
default values. In general the ldap user profiles should contain
user attributes only in special user cases.
* Tune thread pool parameters to match your size requirements. Set
`max_requests_per_server` to zero to avoid server thread restarts.
* Enlarge the timeout (10 secs) and retries (5-7) in the access servers
for accounting. That way you won’t lose any accounting information.
* Use well tuned Fast Ethernet connections to minimize latency.
* freeradius is multi threaded and i/o bound. That means you should use
the latest OS kernels/patches for improved multi processor and network
performance.

== LDAP Module

* Try to maximize caching in the ldap server. In particular _always_
enable indexing of the uid attribute (equality index) and the cn
attribute (equality index - the cn attribute is used to search for
groups). Make the ldap server entry/directory cache memory sizes as
large as possible. In general try allocating as much memory as you can
afford to your ldap server.
* Put default profiles in ldap. User entries should only contain non
standard values in order to remain small and maximize the gains of
caching the user default/regular profiles.
* Enable group caching in groups.

== SQL Module

* Use the sql module in the session section instead of the radutmp
module. It works _much_ quicker.
* Create a multi column index for the (`UserName`, `AcctStopTime`)
attributes especially if you are using sql for double login detection.
* If you are using mysql and you do a lot of accounting try using InnoDB
for the radacct table instead of MyISAM (this should be the default in
all schemas)
* Add `AcctUniqueId` in the `Acct-Status-Type = Stop` query.
Especially if you have a lot of access servers or your NAS does not send
very random Session-Ids. That way you will always have one candidate row
to search for, instead of all the rows that have the same
`AcctSessionId`.

== RADUTMP Module

* Enable noatime on the radutmp file
* Don’t use it
